Release 0.3.35

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

Cargo.lock

@@ -2948,7 +2948,7 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.3.30"
+version = "0.3.35"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.3.31"
+version = "0.3.35"
 edition = "2021"
 
 [lib]

README.md

@@ -70,7 +70,10 @@ stream.
 - **Answer chains** (`src/chain.rs`): each submission hashes its
   parent(s), so a visitor's path through the questions is a verifiable
   lineage; `?chain=` links carry it, and self-service transitions
-  (unsubscribe) authorize by holding one.
+  (unsubscribe) authorize by holding one. The question nav reads it
+  too: a `followup` page is offered only when it is on that path (the
+  page the chain verifiably answered) or further down from the current
+  page over `action` edges - one followup path never unlocks another.
 - **Live resources** (`src/resource.rs`): content can pull a KV
   bucket, Gitea starred/org repos/releases, or any public JSON URL
   (SSRF fail-closed), reshaped by a content-declared `jq` filter.

src/app.rs

@@ -1,5 +1,5 @@
 use leptos::prelude::*;
-use leptos_meta::{provide_meta_context, HashedStylesheet, Html, MetaTags, Stylesheet, Title};
+use leptos_meta::{provide_meta_context, HashedStylesheet, Html, Link, MetaTags, Stylesheet, Title};
 use leptos_router::{
     components::{Route, Router, Routes},
     hooks::{use_location, use_navigate, use_query_map},
@@ -40,6 +40,20 @@ pub fn shell(options: LeptosOptions) -> impl IntoView {
                 // once loaded via <link>/<img> on Safari/iOS.
                 <link rel="icon" media="(prefers-color-scheme: light)" href="/favicon-light.svg" type="image/svg+xml"/>
                 <link rel="icon" media="(prefers-color-scheme: dark)" href="/favicon-dark.svg" type="image/svg+xml"/>
+                // Fonts hide behind the stylesheet: the browser must
+                // fetch and parse CSS before it discovers them. The
+                // latin subset is on every page's critical path, so
+                // announce it up front; latin-ext and vietnamese stay
+                // unicode-range-gated and load only when script needs
+                // them - preloading those would tax everyone for a few.
+                // (Font preloads require crossorigin even same-origin.)
+                <link
+                    rel="preload"
+                    href="/fonts/quicksand-semibold-latin.woff2"
+                    r#as="font"
+                    type="font/woff2"
+                    crossorigin="anonymous"
+                />
                 // Server-side, so it can read hash.txt and link the
                 // content-hashed stylesheet (hash-files = true).
                 <HashedStylesheet id="leptos" options=options.clone()/>
@@ -89,10 +103,34 @@ pub fn App() -> impl IntoView {
             .and_then(|s| s.stylesheet)
             .map(|p| format!("/site/{p}"))
     });
+    // The wordmark paints in the hero on first view; announcing it in
+    // the head starts the fetch during hydration instead of after. On
+    // redoal.com it lives on the content host, so a preconnect opens
+    // that TLS session while the preload is still queued.
+    let wordmark_href = Memo::new(move |_| {
+        site.get().and_then(|r| r.ok()).and_then(|s| s.wordmark)
+    });
+    let wordmark_origin = Memo::new(move |_| {
+        wordmark_href.get().and_then(|w| {
+            let rest = w.strip_prefix("https://")?;
+            Some(format!("https://{}", rest.split('/').next()?))
+        })
+    });
+    // A content-shipped favicon overrides the built-in one; injected
+    // into the head after the static defaults, so it wins.
+    let favicon = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.favicon)
+            .map(|p| format!("/site/{p}"))
+    });
 
     view! {
         <Html attr:lang=move || lang.get()/>
+        {move || wordmark_origin.get().map(|href| view! { <Link rel="preconnect" href=href crossorigin="anonymous"/> })}
+        {move || wordmark_href.get().map(|href| view! { <Link rel="preload" as_="image" href=href/> })}
         {move || custom_css.get().map(|href| view! { <Stylesheet id="site-custom" href=href/> })}
+        {move || favicon.get().map(|href| view! { <Link rel="icon" href=href/> })}
         <Suspense fallback=|| ()>
             {move || {
                 site.get()
@@ -175,7 +213,10 @@ fn PortalShell() -> impl IntoView {
         |(path, chain)| get_question(path, chain),
     );
     let user = Resource::new(|| (), |_| current_user());
-    let nav = Resource::new(move || chain.get().is_some(), list_qualifying_questions);
+    let nav = Resource::new(
+        move || (path.get(), chain.get()),
+        |(path, chain)| list_qualifying_questions(path, chain),
+    );
     let announcements = Resource::new(|| (), |_| list_announcements());
     provide_context(QuestionRes(question));
     provide_context(UserRes(user));
@@ -251,7 +292,6 @@ fn QuestionView(
     site: SiteConfig,
 ) -> impl IntoView {
     let question_id = question.id.clone();
-    let has_chain = parent_hash.is_some();
 
     // The provenance counterpart to the qualifies gate below: a
     // requires_chain page whose visitor holds no verifiable lineage to
@@ -280,7 +320,7 @@ fn QuestionView(
                 </section>
             </div>
             // A gate is never a dead end: the same nav as every page.
-            <QuestionNav current_id=question_id has_chain=has_chain/>
+            <QuestionNav current_id=question_id/>
         }
         .into_any();
     }
@@ -317,7 +357,7 @@ fn QuestionView(
                     }}
                 </section>
             </div>
-            <QuestionNav current_id=question_id has_chain=has_chain/>
+            <QuestionNav current_id=question_id/>
         }
         .into_any();
     }
@@ -380,7 +420,7 @@ fn QuestionView(
             .map(|r| {
                 view! { <ResponsibleNote responsible=r/> }
             })}
-        <QuestionNav current_id=question_id has_chain=has_chain/>
+        <QuestionNav current_id=question_id/>
     }
     .into_any()
 }
@@ -389,8 +429,7 @@ fn QuestionView(
 /// small nav - how a concern reaches the people it speaks to without
 /// claiming front-page space (an owner also sees the gated desks here).
 #[component]
-fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
-    let _ = has_chain; // keyed into the shared resource by PortalShell
+fn QuestionNav(current_id: String) -> impl IntoView {
     let NavRes(nav) = expect_context();
     view! {
         <Suspense fallback=|| ()>
@@ -1991,16 +2030,21 @@ pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
     Ok(state.site.load().as_ref().clone())
 }
 
-/// Every question the current visitor qualifies for, as (id, name) -
-/// the site nav's data. Context-dependent: an owner session sees the
-/// gated pages too, and `followup` pages only appear once the visitor
-/// carries an answer chain.
+/// Every question the visitor may be offered from `current`, as (id,
+/// name) - the question nav's data. Front-door pages the visitor
+/// qualifies for are always in (an owner session sees the gated desks
+/// too); `followup` pages and ended events only when they are on the
+/// visitor's path - the page their verified `?chain=` answered - or
+/// further down from `current` (see `content::outcomes_reachable_from`).
+/// A chain unlocks the followup it came from, never every followup on
+/// the site; an unverifiable hash unlocks nothing.
 #[server(endpoint = "list_qualifying_questions")]
 pub async fn list_qualifying_questions(
-    has_chain: bool,
+    current: String,
+    chain: Option<String>,
 ) -> Result<Vec<(String, String)>, ServerFnError> {
     use crate::auth::{User, SESSION_USER_KEY};
-    use crate::content::is_qualified;
+    use crate::content::{is_qualified, outcomes_reachable_from, Question};
     use crate::server::AppState;
 
     let state = expect_context::<AppState>();
@@ -2011,14 +2055,27 @@ pub async fn list_qualifying_questions(
         .map_err(|e| ServerFnError::new(e.to_string()))?;
 
     let now_ms = chrono::Utc::now().timestamp_millis();
-    let mut out: Vec<(String, String)> = state
-        .questions
-        .load()
+    let questions = state.questions.load();
+    // The one page the chain verifiably answered - the same lookup a
+    // `requires_chain` gate does, so a forged or foreign hash resolves
+    // to nothing relevant.
+    let answered: Option<String> = match &chain {
+        Some(hash) => crate::chain::lookup_node(&state.jetstream, hash)
+            .await
+            .map(|node| node.question_id),
+        None => None,
+    };
+    // An ended event page is a followup from then on.
+    let is_outcome = |q: &Question| q.is_followup() || q.event_ended_at(now_ms);
+    let reach = outcomes_reachable_from(&questions, &current, &is_outcome);
+    let mut out: Vec<(String, String)> = questions
         .values()
         .filter(|q| is_qualified(user.as_ref(), q))
-        // An ended event page is a followup from then on - only a
-        // visitor carrying a chain (they answered it) still sees it.
-        .filter(|q| !(q.is_followup() || q.event_ended_at(now_ms)) || has_chain)
+        .filter(|q| {
+            !is_outcome(q)
+                || answered.as_deref() == Some(q.id.as_str())
+                || reach.contains(&q.id)
+        })
         // A live event is announced in the header instead.
         .filter(|q| !q.event_live_at(now_ms))
         // A dynamic page has no URL of its own to link to.

src/content.rs

@@ -42,8 +42,11 @@ pub struct Question {
     #[serde(default)]
     pub responsible: Option<Responsible>,
     /// A page that only makes sense after answering something (the
-    /// post-submission pages) - kept out of the question nav unless the
-    /// visitor's context carries an answer chain. Unset means inferred
+    /// post-submission pages) - kept out of the question nav unless it is
+    /// on the visitor's path (the page their verified `?chain=` answered)
+    /// or further down from the page they are on, over `action` edges
+    /// (see `outcomes_reachable_from`). One followup path never unlocks
+    /// another. Unset means inferred
     /// from the file's place in the tree: files nested in a
     /// subdirectory are followups unless they're the directory's
     /// `index.yaml`; top-level files keep the historical default
@@ -611,6 +614,10 @@ pub struct SiteConfig {
     /// same-origin at `/site/<path>`; plain path only.
     #[serde(default)]
     pub stylesheet: Option<String>,
+    /// A content-repo-relative favicon (svg/png/ico), served at
+    /// `/site/<path>` and used in place of the built-in one.
+    #[serde(default)]
+    pub favicon: Option<String>,
     #[serde(default)]
     pub hero: HeroConfig,
 }
@@ -673,6 +680,14 @@ impl SiteConfig {
                 );
             }
         }
+        if let Some(icon) = &self.favicon {
+            let ok = [".svg", ".png", ".ico"].iter().any(|e| icon.ends_with(e));
+            if !is_safe_site_path(icon) || !ok {
+                anyhow::bail!(
+                    "site.yaml: favicon {icon:?} must be a plain repo-relative .svg/.png/.ico path"
+                );
+            }
+        }
         Ok(())
     }
 }
@@ -910,6 +925,74 @@ pub fn path_matches(pattern: &str, path: &str) -> Option<Vec<(String, String)>>
     Some(captures)
 }
 
+/// The question an alternative's `action` lands on, as a question id:
+/// a plain path resolves directly, a templated one
+/// (`/shape/{curve.key}`) to the dynamic page whose pattern has the
+/// same shape (`/shape/[key]`). `None` when no page declares it.
+pub fn action_target_id(
+    questions: &std::collections::HashMap<String, Question>,
+    action: &str,
+) -> Option<String> {
+    if questions.contains_key(action) {
+        return Some(action.to_string());
+    }
+    let want: Vec<&str> = action.split('/').filter(|s| !s.is_empty()).collect();
+    questions
+        .values()
+        .filter(|q| q.is_dynamic())
+        .map(|q| &q.id)
+        .find(|id| {
+            let pat: Vec<&str> = id.split('/').filter(|s| !s.is_empty()).collect();
+            pat.len() == want.len()
+                && pat
+                    .iter()
+                    .zip(&want)
+                    .all(|(p, w)| p == w || (p.starts_with('[') && w.starts_with('{')))
+        })
+        .cloned()
+}
+
+/// The outcome pages "further down" from `from`: every `is_outcome`
+/// question reachable from it over `alternatives[].action` edges,
+/// walking only *through* outcome pages. A front-door page (not an
+/// outcome) is where the walk ends, so a "back to the start" action
+/// never fans out into the whole site. `from` itself is never in the
+/// result. This, plus the one page a visitor's verified chain answered,
+/// decides which followups the question nav offers - one followup path
+/// never unlocks another (an email-link page like redoal's `/watching`,
+/// which nothing links to, stays out of every nav).
+pub fn outcomes_reachable_from(
+    questions: &std::collections::HashMap<String, Question>,
+    from: &str,
+    is_outcome: &dyn Fn(&Question) -> bool,
+) -> std::collections::HashSet<String> {
+    use std::collections::{HashSet, VecDeque};
+    let mut seen: HashSet<String> = HashSet::new();
+    let mut queue: VecDeque<Question> = VecDeque::new();
+    if let Some(q) = resolve_question(questions, from) {
+        queue.push_back(q);
+    }
+    while let Some(q) = queue.pop_front() {
+        for action in q.alternatives.iter().filter_map(|a| a.action.as_deref()) {
+            let Some(id) = action_target_id(questions, action) else {
+                continue;
+            };
+            // A page's own dynamic pattern (`/shape/abc` -> `/shape/[key]`)
+            // is itself, not somewhere further down.
+            if id == from || path_matches(&id, from).is_some() || seen.contains(&id) {
+                continue;
+            }
+            let target = &questions[&id];
+            if !is_outcome(target) {
+                continue;
+            }
+            seen.insert(id.clone());
+            queue.push_back(target.clone());
+        }
+    }
+    seen
+}
+
 /// Resolves a URL path to its question: an exact id first, else the
 /// one dynamic page whose pattern matches, with each captured segment
 /// substituted into `{name}` placeholders in the clone's resource keys
@@ -1537,6 +1620,7 @@ pub async fn site_asset_handler(
         Some("png") => "image/png",
         Some("webp") => "image/webp",
         Some("avif") => "image/avif",
+        Some("ico") => "image/x-icon",
         Some("woff2") => "font/woff2",
         _ => "application/octet-stream",
     };
@@ -1948,6 +2032,48 @@ alternatives:
         assert!(!questions.contains_key("/review/_draft"));
     }
 
+    #[test]
+    fn followups_surface_by_reach_not_by_carrying_any_chain() {
+        use std::collections::HashSet;
+        let files = vec![
+            // Front door with three outcomes, one of them templated onto
+            // a dynamic page.
+            ("index.yaml".to_string(), "name: Home\nalternatives:\n  - name: apply\n    action: applied\n  - name: subscribe\n    action: subscribed\n  - name: draw\n    action: /shape/{curve.key}\n".to_string()),
+            ("applied.yaml".to_string(), "name: Applied\nfollowup: true\n".to_string()),
+            ("subscribed.yaml".to_string(), "name: Subscribed\nfollowup: true\nalternatives:\n  - name: back\n    action: /\n".to_string()),
+            // Nested -> followup by inference; leads on to /subscribed.
+            ("shape/[key].yaml".to_string(), "name: Shape\nalternatives:\n  - name: watch\n    action: /subscribed\n  - name: back\n    action: /\n".to_string()),
+            // Reached only by an out-of-band link: nothing points here.
+            ("watching.yaml".to_string(), "name: Watching\nfollowup: true\n".to_string()),
+            // A second, unrelated path with its own outcome.
+            ("kontakt.yaml".to_string(), "name: Kontakt\nalternatives:\n  - name: send\n    action: takk\n".to_string()),
+            ("takk.yaml".to_string(), "name: Takk\nfollowup: true\nalternatives:\n  - name: back\n    action: /\n".to_string()),
+        ];
+        let questions = build_questions(&files).unwrap();
+        let is_outcome = |q: &Question| q.is_followup();
+        let reach = |from: &str| outcomes_reachable_from(&questions, from, &is_outcome);
+        let set = |ids: &[&str]| ids.iter().map(|s| s.to_string()).collect::<HashSet<_>>();
+
+        // Templated actions resolve to the dynamic page's pattern.
+        assert_eq!(action_target_id(&questions, "/shape/{curve.key}").as_deref(), Some("/shape/[key]"));
+        assert_eq!(action_target_id(&questions, "/nowhere"), None);
+
+        // From the front door: its own outcomes, and what they lead on
+        // to - but not the other path's outcome, nor the orphan.
+        assert_eq!(reach("/"), set(&["/applied", "/subscribed", "/shape/[key]"]));
+        // The other path only sees its own outcome. Its "back to /"
+        // edge ends the walk at the front door instead of fanning out.
+        assert_eq!(reach("/kontakt"), set(&["/takk"]));
+        // Standing on an outcome: nothing further down through outcomes.
+        assert_eq!(reach("/subscribed"), set(&[]));
+        assert_eq!(reach("/takk"), set(&[]));
+        // The email-link page reaches nothing and nothing reaches it.
+        assert_eq!(reach("/watching"), set(&[]));
+        // A concrete dynamic path resolves to its pattern and walks on;
+        // the pattern itself is not "further down" from its own page.
+        assert_eq!(reach("/shape/abc"), set(&["/subscribed"]));
+    }
+
     #[test]
     fn declared_id_wins_over_path() {
         let files = vec![(

style/main.css

@@ -147,6 +147,10 @@ a {
 main.loading,
 main.not-found {
   min-height: 60vh;
+  /* svh so wrapper browsers that resize the webview as their toolbar
+     animates (Firefox/Chrome iOS) don't reflow this placeholder - the
+     small viewport is a fixed value. Same ladder as .hero-piece. */
+  min-height: 60svh;
   display: flex;
   flex-direction: column;
   align-items: center;
@@ -1041,6 +1045,9 @@ textarea:focus {
 .item-card-description {
   font-size: 0.9rem;
   color: var(--ink-dim);
+  /* The card is a grid with its own gap; the global p bottom margin
+     would stack on top of it. */
+  margin: 0;
 }
 
 .item-card-fields {